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1. 


INTRODUCTION 


1 . 1 BACKGROUND 


An  objective  of  environmental  design  research  at  the  National  Bureau  of 
Standards  (NBS)  is  the  production  and  application  of  knowledge  leading 
to  more  useful  buildings.  Buildings  can  be  made  more  useful,  it  will  be 
argued,  by  more  adequately  providing  for  the  privacy  of  occupants  and 
users.  From  a scientific  perspective,  good  theory  should  help  such  an 
enterprise  because  good  theory  creates  understanding  of  phenomena  and 
guides  their  measurement  and  application.  This  report  proposes  a social 
psychological  and  environmental  framework  for  constructing  a theory  of 
privacy  applicable  to  the  built  environment. 

If  we  limit  ourselves  to  privacy  and  buildings,  a review  of  the  relevant 
literature  leads  to  the  conclusion  that  privacy  is  an  important,  some- 
times a critical,  factor  in  a number  of  settings  including:  offices 

(Justa  and  Golan,  1977;  "The  Trouble  with  Open  Offices,"  1978);  hospi- 
tals (Cammock,  1975;  Thompson  and  Goldin,  1975;  Veterans  Administration, 
1977);  prison  (Filipczak,  1973);  banks  (Prather,  1972);  and  in  what  may 
be  the  most  studied  setting  with  regard  to  privacy,  housing. 

Housing  occupants,  both  in  their  choice  of  housing  ("What  Buyers  Say 
They  Want  in  Housing  in  1978,"  1978)  and  in  their  evaluation  of  it 
(Cooper,  1975;  Francescato,  Weidemann,  Anderson  and  Chenoweth,  1975; 
Sanoff  and  Sawhney,  1972)  mention  privacy  considerations.  As  a rule, 
being  able  to  have  and  maintain  privacy  is  evaluated  favorably  and  not 
being  able  to  obtain  privacy  or  having  one's  privacy  violated  is  evalu- 
ated unfavorably.  Designers  of  housing  share  occupants'  belief  that 
privacy  is  important  and  should  be  supported  by  the  design  of  occupants ' 
housing  and  sites  (Chermayeff  and  Alexander,  1965;  Churchman  and 
Herbert,  1978). 

Studies  of  housing  that  discuss  the  role  of  privacy  in  occupant 
satisfaction  raise  a number  of  points  which  theories  of  privacy  should 
consider. 

1.  Privacy  requirements  appear  to  be  universal,  although  the  forms  they 
take  are  culturally  variable  (Altman,  1977;  Rapoport,  1969). 

2.  In  studies  in  Western  societies,  a large  number  of  housing  and 
site  features  have  been  associated  with  privacy.  These  include 
plumbing,  windows,  walls  and  fences,  and  the  layout,  location  and 
orientation  of  a dwelling  (Cooper,  1975;  Francescato  et  al. , 1975; 
Mautz , n.  d.  ). 

3.  A particular  environmental  feature  (e.g.,  a fence)  may  be  associated 
with  more  than  one  situational  attribute  (e.g.,  privacy,  security, 
safety).  In  some  cases,  the  feature  can  support  the  different 
attributes;  in  other  cases,  the  attributes  conflict  (e.g.,  Cooper, 
1975). 
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4.  Visual  and  auditory  privacy  are  common  foci  for  comment.  (It  is 
likely  that  in  settings  where  odors  can  be  significant  threats  to 
personal  privacy,  such  as  in  hospital,  this  foci  would  be  more 
common. ) 

5.  Although  current  housing  research  has  demonstrated  an  association 
between  the  built  environment  and  occupant's  comments  about  privacy, 
the  relationship  has  yet  to  be  explained.  That  is,  how  does  the 
built  environment  affect  behavior? 

Two  specific  examples  will  tie  these  considerations  to  building 
usefulness.  In  both  examples,  occupant  satisfaction  is  the  indicator  of 
utility.  The  first  example,  involving  visual  privacy,  is  from  a Swedish 
study  ("Convenience  versus  Privacy,"  1973)  which  compared  opinions  of 
occupants  of  apartments  in  different  types  of  housing.  Occupants  of 
balcony-access  housing  had  privacy  problems.  In  this  housing,  apart- 
ments are  entered  from  balconies  that  ran  the  length  of  the  buildings. 
The  balconies  are  part  of  the  circulation  system  for  the  buildings.  In 
these  apartments,  the  kitchens  were  the  only  room  to  face  the  balcony. 
Kitchen  windows  created  a keenly  felt  lack  of  privacy.  The  households 
that  felt  this  loss  of  privacy  (nearly  half  of  all  interviewed  house- 
holds in  these  buildings)  expressed  little  enthusiasm  for  the  concept  of 
balcony-access  living,  a design  concept  that,  at  the  time  of  the  study, 
had  been  receiving  increasing  attention  in  Sweden.  Although  the  simple 
expedient  of  screening  the  lower  half  of  the  kitchen  window  considerably 
reduced  the  complaints  about  visual  intrusions  by  passers-by,  this  solu- 
tions also  impaired  the  view  and  reduced  the  admission  of  sunlight  into 
the  kitchen,  two  new  undesirable  consequences.  Thus,  the  location  of 
the  kitchen  window  can  be  regarded  as  a design  decision  that  reduced  the 
utility  of  these  buildings. 

An  American  study  (Cooper,  1975)  of  families  in  low-cost  row  housing 
provides  the  second  example.  The  issue,  here,  is  the  consequences  of 
design  and  construction  decisions  on  auditory  privacy  of  occupants. 

The  housing  was  wood-frame  construction,  with  party  walls  of  staggered 
studs  separated  by  rock  wool  bats.  To  produce  a variety  of  interiors, 
the  units  were  designed  with  overlapping  room  arrangements,  so  stairs 
in  one  unit  ran  past  the  kitchen  of  another  and  a bedroom  in  one  unit 
was  over  the  living  room  of  another.  As  a result,  for  many  occupants, 
noise  was  a serious  problem.  For  example,  tenants  found  themselves 
overhearing  quarrels  in  other  apartments  they  did  not  want  to  hear. 
Moreover,  occupants  recognized  that  what  was  happening  in  their  own 
apartments  could  be  heard  by  their  neighbors.  The  lack  of  auditory 
privacy  was  a source  of  considerable  adverse  comment,  both  as  a source 
of  embarrassment  and  as  an  annoyance.  For  this  occupant  group,  building 
design  and  construction  decisions  created  sound  transmission  problems 
that  reduced  the  utility  of  these  buildings.  A good  theory  of  privacy 
could  have  been  a means  of  addressing  and  resolving  the  privacy  problems 
found  in  this  and  in  the  Swedish  studies. 
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1.2  STATUS  OF  CURRENT  THEORIES  OF  PRIVACY 


During  the  1970's,  there  have  been  signs  of  increasing  interest  among 
behavioral  scientists  and  environmental  design  researchers  in  privacy 
(Margulis,  1975,  1977c).  This  interest  reflects,  in  part,  a desire  to 
understand  the  relationship  between  buildings  and  people,  and  to  more 
completely  explain  the  nature  of  social  relationships.  The  interest 
undoubtedly  reflects,  too,  a growing  citizen  and  governmental  concern 
with  actual  and  potential  abuses  of  privacy  (Margulis,  1977b). 

Has  this  interest  in  privacy  resulted  in  good  theories  of  privacy?  An 
answer  to  this  question  rests  on  two  assumptions.  First,  privacy  is  an 
important,  if  not  central,  socioenvironmental  concept  (Altman,  1975; 
Canter  and  Kenny,  1975).  Second,  understanding  privacy  requires  an  ade- 
quate explanation  of  how  the  physical  environment  determines,  influences 
or  provides  support  for  behavior.  Unfortunately,  not  all  who  endorse 
the  first  assumption  have  tried  to  link  their  ideas  about  behavioral 
aspects  of  privacy  with  conceptually  adequate  representations  of  the 
nature  and  functioning  of  the  physical  environment  (Levy,  1976).  Conse- 
quently, it  is  concluded  that  current  theories  of  privacy  are,  for  the 
most  part,  insufficiently  developed  for  fully  understanding  privacy  and, 
consequently,  are  of  only  limited  use  in  solving  practical  environmental 
problems  involving  privacy  (Margulis,  1977a). 

1.3  THE  SCOPE,  AIM  AND  ORGANIZATION  OF  THE  REPORT 

This  report  is  part  of  a continuing  attempt  to  create  a framework  within 
which  a theory  of  privacy  can  be  developed.  It  is  unlike  many  of  the 
major  theories  of  privacy  (e.g.  , Altman,  1975;  Laufer  and  Wolfe,  1977) 
that  have  been  developed  in  the  last  decade  which  specifically  try  to 
bring  order  to  the  many  meanings  of  privacy  found  in  the  technical  and 
nontechnical  literature  (Margulis,  1977a).  By  contrast,  the  framework 
is  narrow  in  scope.  It  limits  privacy  to  certain  conditions  of  limiting 
and  protecting  information.  Other  conditions  of  information  management, 
such  as  those  associated  with  secrecy  (Warren  and  Laslett,  1977), 
espionage  (Wilsnack,  in  press)  and  censorship  (Margulis,  1977a), 
presently  fall  outside  of  the  proposed  framework.  Furthermore,  unlike 
many  other  current  theories  of  privacy,  the  present  framework  strongly 
endorses  the  position  that  a complete  understanding  of  privacy  requires 
a complete  understanding  of  the  nature  and  functioning  of  the  objective 
physical  environment.  In  all,  this  effort  at  concept  development  is 
predicated  on  the  belief  that  a theory  of  privacy  and  its  associated 
measurement  methodologies,  based  on  the  proposed  framework,  can  be  of 
potential  use  for  addressing  privacy  requirements.  The  resulting  know- 
ledge, in  principle,  can  be  applied  to  housing  and  site  design  deci- 
sions, construction  decisions,  building  management  decisions,  and  to 
regulatory  and  zoning  decisions  affecting  buildings. 

The  aim  of  this  report  is  to  introduce,  briefly  and  nontechnically , some 
of  the  ideas  about  privacy  that  the  author  has  been  developing.  This 
report  does  not  attempt  to  systematically  review,  summarize  or  critique 
particular  theories  of  privacy  or  the  research  literature  on  privacy, 
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other  than  the  material  appearing  in  Sections  1.1  and  1.2.  Reviews 
of  theory  and  research  can  be  found  in  Margulis  (1975,  1977c). 

Organizationally,  the  report  introduces  behavioral  aspects  of  privacy  in 
the  early  sections  (Section  2. 1-2. 6)  and  environmental  considerations  in 
a later  section  (Section  2.7). 
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PRIVACY  AS  INFORMATION  MANAGEMENT:  AN  INTRODUCTION  TO  A FRAMEWORK 


2. 1 WHAT  IS  PRIVACY? 

The  essential  focus  of  this  analysis  of  privacy  is  the  strategic  and 
tactical  management  of  information,  specifically  information  whose  loss 
would  have  costly  consequences  for  the  person  who  is  the  target  of  the 
information.  Such  information  will  be  called  "personal"  or  "private" 
information  because  the  person,  P,  the  target  individual  in  the  analy- 
sis, feels  he  or  she  has  a claim  to  the  information  (i.e.,  feels  it 
rightfully  belongs  to  him/her).  It  is  assumed  that  if  there  is  no  such 
claim,  there  is  no  issue  for  P with  regard  to  informational  privacy. 
However,  one  seldom  finds  a direct  test  of  this  assumption.  Rather, 
if  there  is  intentional  protection  of  information  and  intentional  con- 
trol of  access  to  the  information,  and  if  there  are  stressful  reactions 
to  unwarranted  and  unwanted  access  to  the  information,  these  serve  as 
clues  to  asserting  that  the  information  is  regarded  as  personal  and 
requires  management.  Put  another  way,  the  basic  question  for  P is: 

Who  knows  or  could  know  about  X (the  private  information  of  P,  which 
includes  its  linkage  with  P),  and  what  are  the  consequences  to  me  (P) 
if  a particular  Other  (other  person),  0,  knows  about  X (or  P-X,  its 
linkage  with  P),  now  or  in  the  future? 

The  question  poses  three  problems  for  P to  consider.  P's  response  to 
each  of  these  problems  will  determine  whether  information  management  is 
an  issue  and,  if  it  is,  the  nature  of  information  management.  The 
three  problems  are: 

1.  Deciding  who  should  and  who  should  not  know  about  X.  This  decision 
is  built  on  a number  of  antecedent  judgments  and  evaluations  of 
one's  self,  of  the  information,  of  the  setting,  of  the  potential 
recipient,  etc.  For  example,  there  are  clearly  those  with  whom  P 
would  want  to  share  private  information  and  others  that  P would 
clearly  want  to  exclude.  However,  there  is  a third  class:  people 

whose  presence  during  a private  event  is  a matter  of  indifference 
to  P.  Such  persons  are  not  regarded  by  P as  threats  to  information 
management.  Consequently,  when  these  persons  are  physically  present 
during  a private  event,  they  may  be  treated  by  P as  being  "not  pre- 
sent" (Goffman,  1959).  Examples  of  such  "non-persons,"  to  use 
Goffman's  (1959)  term,  are  infants,  slaves  and  servants,  and  service 
workers,  such  as  simultaneous  translators  and  court  stenographers, 
whose  effectiveness  is  enhanced  when  they  are  treated  as  "not 
present. " 


2.  Having  the  competence  to  control  one's  communications  so  that  those 
who  should  not  know  about  X or  P-X  do  not  learn  about  it.  Compe- 
tence implies  the  ability  or  skill,  of  both  the  sender  and  receiver 
of  information,  to  each  control  his/her  own  response  to  internally 
or  externally  generated  messages,  and  to  encode  and  decode  messages. 
This  means,  in  part,  that  one  person's  (P's)  ability  to  "keep"  or 
control  a "secret”  is  measurable  against  another  person's  (0's) 
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ability  to  "read"  or  gain  access  to  that  "secret".  In  turn,  0 may 
now  be  measured  by  0's  ability  to  keep  his  or  her  successful  breach 
of  P’s  "secret"  from  P.  Theoretical  statements  about  competence 
presume  that  P wants  to  control  certain  situations  and  settings. 

It  is  assumed  that  competency  is  not  uniform  across  persons,  stages 
in  one’s  life  cycle,  one’s  internal  states,  tasks  (particularly 
encoding  versus  decoding  messages),  and  classes  of  content.  Communi- 
cation refers  to  the  content  and  flow  of  information  from  P to  others 
and  from  those  recipients  to  additional  others  (through  any  and  all 
channels  of  communication). 

3.  Managing  one's  failure  to  control  information  as  well  as  managing 
the  consequences  of  having  information  (X  or  P-X)  fall  into  the 
possession  of  those  whom  P believes  should  not  have  it. 

An  example  will  illustrate  these  three  problems.  Imagine  a hungry 
child  enticed  into  the  kitchen  by  the  thought  of  a delicious  cookie,  a 
forbidden  treat.  The  child  knows  his  parents  disapprove  of  snacks, 
especially  before  mealtimes,  and  that  they  will  punish  him  for  eating 
such  snacks.  [This  illustrates  Problem  1.]  Nevertheless  the  child  eats 
the  cookies  greedily.  Although  unseen  and  unheard,  traces  of  evidence 
remain:  crumbs  on  the  floor  and  tell-tale  food  stains  about  the  mouth. 

Confronted  by  his  parents,  the  surprised  child  stares  wide-eyed  but 
otherwise  remains  silent.  The  evidence  and  his  response  to  the  interro- 
gation — a pattern  of  responding  which  the  parents  believe  is  associated 
with  wrong-doing  — plus  the  child's  sluggish  appetite  during  dinner, 
reinforce  the  parents'  suspicions.  The  child's  silence  in  this  context 
is  regarded  as  a social  equivalent  of  a "no  contest"  plea.  [This  illu- 
strates Problem  2.]  The  child  is  punished.  [This  illustrates 
Problem  3. ] 

Thus  far,  we  have  described  and  illustrated  privacy.  However,  a formal 
definition  is  in  order.  Privacy  refers  to  behaviors  of  the  individual 
that  are  intended  to  or  that  express  or  test  the  individual's  competence 
to  control  the  flow  and/or  content  of  information  transmitted  to  a 
specifiable  audience  (network)  of  others.  This  formal  definition  of 
privacy  refers  to  information  to  which  a person  (P)  believes  he  or  she 
has  a legitimate  claim;  the  person  believes  the  information  belongs  to 
him  or  her.  It  might  be  thought  of  as  "cognitive  property."  This  claim 
(by  P)  is  either  exclusive  ("I  and  no  one  else  can  make  a claim  to  this 
information"),  or  shared  ("Others  have  or  can  raise  a legitimate  claim 
to  this  information").  In  either  case,  it  is  a posited  characteristic 
of  this  claim  that  P will  regard  the  withholding  or  transmission  of  the 
the  information  as  a matter  of  P's  voluntary  assent. 

There  are  at  least  three  bases  for  a claim  over  information.  One  basis 
is  being  the  creator  of  the  information.  This  would  include  one's  own 
thoughts  and  ideas  or  one's  evaluation  of  or  thinking  through  the 
thoughts  or  ideas  of  others.  A second  basis  is  a normatively  defined 
and  recognized  relationship  between  a person  (P)  and  information  (X, 

P-X).  One's  name  and  other  indicators  of  personal  identity  are 
examples.  A third  basis  is  the  obligations  of  P toward  those  who  have 
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shared  private  information  with  P.  Examples  are  confidences  which  are 
shared  because  of  social  bonds  of  love  or  trust,  or  through  necessity. 
Information  shared  of  necessity  includes  revelations  by  the  penitent  to 
the  priest,  by  the  client  to  the  lawyer,  and  by  the  patient  to  the 
physician.  Personal  obligations  built  on  social  bonds  of  love  and  trust 
are  the  reasons  for  protecting  personal  "secrets”  and  confidences;  per- 
sonal obligations  built  on  legal  and  professional  requirements  are  often 
the  reasons  for  protecting  "secrets"  and  confidences  shared  of  necessity. 

2.2  INFORMATION  AND  COMMUNICATION 


The  terms  "information"  and  "communication"  are  used  broadly.  Many 
facets  of  observable  human  behavior  are  regarded  as  potentially 
informational  and  as  communicable.  Thus,  communication  is  not  limited 
to  exchanges  that  are  spoken  or  written,  although  these  are  important, 
but  communication  extends  to  dress,  physical  appearance  and  health,  use 
of  space,  paralanguage,  and  kinesics  ("body  language"). 

A communicative  act  (communication),  formally  speaking,  is  a transmis- 
sion of  information  from  a source  to  a recipient.^-  ("Transmission"  is 
used  as  a synonym  for  "communicative  act”  here.)  Information,  in  formal 
terms,  is  that  which  is  discriminable,  classifiable,  or  meaningful 
(particularly  for  the  receiver  of  the  information).  Because  this  may 
seem  far  removed  from  the  use  of  the  term  thus  far,  we  will  define 
"information”  informally  as  anything  that  makes  a difference  to  or 
which  is  meaningful  to  a communicator  or  recipient. 

One  class  of  information,  called  "personal"  or  "private"  information,  is 
information  to  which  the  person  lays  claim.  It  is  a characteristic  of 
private  information  that  even  after  it  has  been  transmitted  to  recipi- 
ents, P may  still  regard  it  as  "private"  (i.e. , it  is  still  P's  "cogni- 
tive property").  Consequently,  P may  feel  that  recipients  have  an 
obligation  to  P to  protect  the  private  information  which  P has  shared 
with  them. 

Types  of  information  that  segments  of  contemporary  Western  societies 
might  treat  as  "private",  at  one  time  or  other  during  their  lives, 
include  the  following. 

Health:  includes  mental  and  physical  health,  past  and  present;  illness 

and  treatment,  medicines  taken,  prosthetic  devices;  disabilities, 
disfigurements,  and  other  health-or-body-related  stigma. 

Sexuality:  includes  sexual  practices,  values,  interest;  contraception; 

sexual  dysfunctions;  association  with  pornography  and  sexually 
stimulating  material;  all  social  deviance  of  a sexual  nature. 


This  analysis  draws  on  Newcomb  (1953,  1959). 
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Social  deviance  and  illegal  acts:  includes  criminal  acts,  or  acts 

that  the  person  or  others  might  regard  as  criminal,  immoral,  taboo, 
or  unethical;  criminal  records,  arrests  without  prosecutions. 

Legally  protected  communications:  includes  personnel  files,  credit 

files;  communications  with  lawyers,  physicians,  ministers  that  are 
legally  protected;  corporate  "secrets”  and  their  management  (busi- 
ness-related secrets)  as  well  as  classified  documents.  Key  is  that 
the  communication  between  person  and  other  is  legally  protected  and 
legally  limited  (defined). 

Demographic  or  social  class  information:  includes  all  references  to 

income  and  personal/family  finances,  education,  ethnicity,  religious 
affiliation,  occupation,  residence  where  this  information  of  itself 
is  hidden  because  of  what  it  tells  about  the  person. 

Psychic  preparation  and  psychic  repair:  any  acts  that  permit  the  person 

to  get  his  or  her  emotional,  cognitive,  or  behavioral  array  in 
order;  preparation  for  a public  display  especially  following  stress 
or  grief;  tasks  initially  performed  or  developed  in  private  in 
anticipation  of  a public  presentation. 

Personal  affiliations  and  associations:  persons  or  groups  with  whom  one 

affiliates,  past  or  present,  especially  unpopular,  stigmatized, 
rejected  persons  or  groups. 

Self-defined  or  socially-defined  embarrassments,  limitations,  and  weak- 
nesses: the  "Candid  Camera"  class  of  situations  that  might  be 

embarrassing;  minor  idiosyncratic  problems  that  people  hide. 

2.3  ON  THE  LOSS  OF  PRIVACY 


The  proposed  emphasis  on  both  the  person,  P (the  target  of  personal 
information),  and  on  the  recipients  as  potential  communicators  raises 
two  theoretical  points  upon  which  an  analysis  of  a loss  of  privacy  is 
based.  One  point  focuses  on  the  communicator  of  personal  information. 

A communication  by  P to  certain  recipients  must  be  distinguished  from 
communications  by  those  recipients  to  others.  Furthermore,  the  accept- 
ability of  recipients  as  communicators  and  the  propriety  of  specific 
transmissions  by  recipients  to  yet  additional  recipients  must  be 
considered  from  P’s  perspective.  A second  point  addresses  the  accept- 
ability of  recipients  of  P’s  information  to  P,  regardless  of  who  has 
transmitted  it. 

These  points  have  resulted  in  distinguishing  an  invasion  of  privacy  from 
a violation  of  privacy  — both  of  which  are  losses  of  privacy.  When  an 
unacceptable  person  is  an  audience  to  a transmission  by  P of  private 
information  about  P,  this  is  an  invasion  of  privacy.  A violation  of 
privacy  is  the  unwarranted  presence  (from  P's  perspective)  of  a person 
during  a transmission  of  private  information  about  P by  a recipient  to 
others.  The  violation  of  P's  privacy  occurs  when  initially  acceptable 
or  unacceptable  recipient  transmits  personal  information  about  P to 
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someone  whom  P does  not  regard  as  acceptable.  This  holds  even  when  the 
individual  unacceptable  to  P is  acceptable  to  the  recipient-communicator 
and  is  invited  to  share  the  information.  A violation  of  privacy  means 
that  P has  failed,  for  whatever  reason,  to  control  successfully  the 
dissemination  of  his/her  own  private  information.  Within  this  framework, 
there  can  be  invasions  with  or  without  violations  and  violations  with  or 
without  invasions.  To  illustrate  both  an  invasion  and  a violation, 
imagine  that  a husband  and  wife  are  keeping  confidences  from  their  chil- 
dren. The  presence  of  one  of  their  children  at  such  an  exchange  would 
constitute  an  invasion  of  privacy.  A discussion  of  this  exchange  by 
that  child  with  a brother  or  sister  would  constitute  a violation  of 
priva cy . 

This  analysis  assumes  that  private  information  tends  to  be  shared. 

Sharing  can  be  represented  as  a communication  network  which  is  extended 
over  people,  space,  and  time.  In  principle,  this  network  should 
completely  and  objectively  depict  the  flow  of  information  to  and  from 
all  the  points  (persons)  in  the  network.  It  should  distinguish  between 
transmissions  that  have  and  that  have  not  resulted  in  a loss  of  privacy 
for  whatever  reasons.  It  is  recognized  that  the  reasons  for  the  flow 
may  or  may  not  be  intentional,  planned,  or  justified,  and  that  the  flow 
may  or  may  not  conform  with  the  desires  of  the  target  person. 

There  is  an  important  corollary  of  loss  of  privacy  as  considered.  The 
actual  audience  (i.e.,  those  who  obtained  X,  or  know  P-X)  and  the  audi- 
ence as  it  is  believed  to  be  by  P may  not  correspond.  The  lack  of 
correspondence  may  arise  from  P's  ignorance  about  the  true  state  of 
affairs,  or  from  defensive  or  adaptive  mental  states  which  distort 
perceptions  of  the  communication  network.  Because  such  discrepancies 
can  affect  social  behavior,  it  will  be  necessary,  in  theory  and  in 
research,  to  represent  both  of  P's  audiences  — the  perceived  audience 
and  the  actual. 

The  framework  distinguishes  two  ways  in  which  potential  audiences  can 
affect  privacy  behaviors.  First,  environmental  settings  create  oppor- 
tunities for  persons  who  are  present  or  who  could  come  on  the  scene  to 
invade  or  violate  P's  privacy  (see  Section  1.7).  Second,  P may  consider 
how  future  audiences  might  react  to  current  information  about  P.  Wolfe 
and  Laufer  (1975)  point  out  that  present  day  information  storage  and 
retrieval  technologies  make  future  access  to  current  information  easy, 
at  least  in  principle.  They  note,  for  example,  that  as  opinions  change 
over  time,  previously  legitimate  or  socially  acceptable  information  may 
become  illegitimate  and  unacceptable,  thus  a source  of  vulnerability  if 
future  audiences  gain  access  to  the  information.  An  example  illustrates 
this  point.  Women  graduate  students,  who  participated  in  an  inadequately 
managed  encounter  group,  discovered  that  their  admissions  of  sexual 
interests  and  experiences  before  the  group  later  became  a basis  for 
sexual  propositions  and  harrassment  by  certain  male  participants  and 
other  males  who  gained  unwarranted  access  to  the  group  discussion. 
Conversely,  information  that  creates  vulnerability  in  the  present  may 
become  benign  in  the  future.  For  example,  American  women  who  pressed 
for  their  right  to  vote  were,  at  one  time,  held  in  low  regard.  In  time, 
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this  association  ceased  to  be  an  issue.  Thus,  the  individual  must  cope 
with  time-linked  uncertainty  as  one  aspect  of  the  exercise  of  personal 
control. 

Not  all  losses  of  privacy  require  inordinate  skill  or  effort  in  managing 
the  loss.  Losses  of  privacy  studied  by  experimental  social  psycholo- 
gists, for  example,  tend  to  involve  relatively  low  costs  (Berscheid, 
1977).  More  potent  examples  are  found  in  letters  to  Ann  Landers  and 
Dear  Abby.  No  doubt  it  is  the  potent  implications  of  these  letter  for 
their  writers  that  is  the  reason  why  they  are  published  anonymously. 

2.4  PERSONAL  CONTROL 

Most  contemporary  behavioral  theories  of  privacy  emphasize  that  privacy 
involves  or  depends  upon  one's  competence  to  control  and  understand 
personal  transactions  (Margulis,  1975,  1977b).  The  present  theory  is 
no  exception.  To  illustrate  the  role  of  personal  control:  P is  more 

likely  to  speak  openly  if  P can  limit  his  audience  to  personally  accept- 
able recipients,  and  if  P is  able  to  select  or  plan  a physical  setting 
that  makes  an  invasion  of  privacy  unlikely.  If  these  conditions  are 
not  met,  then  P,  as  an  expression  of  his/her  competence,  might  modify 
the  form,  content,  or  timing  of  a message.  Thus,  bilinguals  who  switch 
languages  to  exclude  others  who  are  present  from  understanding  what  is 
being  said  are  modifying  (controlling)  the  form  of  the  message.  Lying 
and  deception  also  modify  message  form  or  content  in  order  to  protect 
certain  information.  Thus,  evaluating  situations  and  settings  and, 
correspondingly,  evaluating  the  form,  content,  or  timing  of  a message 
are  all  aspects  of  one's  competence  to  control  communications. 

The  framework's  approach  to  personal  control  draws  on  the  analysis  by 
Johnson  (1975).  Briefly,  Johnson  (1975)  argues  that 

there  are  at  least  four  stages  in  the  causal  chain  from  aware- 
ness of  a need  state  to  need  satisfaction  during  which  people 
may  influence  their  outcomes.  Starting  with  the  first  sta^B, 
people  may  choose  their  outcomes...;  next,  they  may  select 
their  behaviors...;  at  the  third  stage  they  may  control  the 
outcomes  themselves  by  exercising  those  behaviors...;  and 
finally,  at  the  fourth  stage  people  may  evaluate  and  interpret 
their  outcomes....  (p.  85) 

He  discusses  these  four  stages  with  respect  to  the  direct  versus  indirect 
relationship  between  a behavior  and  its  outcomes,  which  he  calls  direct 
control  and  indirect  control,  respectively.  According  to  Johnson  (1975), 
privacy  behavior  can  indirectly  or  directly  control  the  flow  or  content 
of  information  to  specifiable  audiences.  Direct  control  represents  the 
behaviors  that  attain  an  intended  outcome;  indirect  control  creates  the 
conditions  that  facilitate  behaviors  resulting  in  direct  control.  If 
making  the  manifest  content  of  a message  inaccessible  to  all  but  a 
designated  audience  is  P's  intent,  then  encrypting  the  message  is  an 
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example  of  direct  control,  and  the  decision  to  encrypt  rather  than  use 
other  strategies  and  the  selection  of  an  appropriate  algorithm  are  both 
examples  of  indirect  control. 

These  are  two  cases  to  which  Johnson's  analysis  of  personal  control  would 
be  applied.  First,  the  prototypical  case,  is  P's  competence  to  control 
information  that  has  been  shared  (with  P or  by  P)  or  that  could  be  shared 
with  yet  additional  others  (by  P or  0).  The  case  is  prototypical  because 
humans  are  social  beings  and  sociality  builds  upon  and  also  results  in 
sharing  of  personal  information.  Typically,  self-disclosures  are  recip- 
rocated. If  disclosure  creates  vulnerability,  then  trust  and  affection 
are  social  mechanisms  for  reducing  vulnerability  through  the  creation  of 
protective  attitudes.  That  is,  sharing  creates  a basis  for  tailoring 
one's  protection  of  another  to  known  (exposed)  sources  of  vulnerability 
(Kelvin,  1977).  Put  in  terms  of  vulnerability,  sociality  is  associated 
with  sharing,  and  sharing  means  that  absolute  control  is  lost.  However, 
through  reciprocal  disclosures,  each  person  gains  a degree  of  control 
over  the  other  since  each  has  made  himself /herself  vulnerable. 

Second,  as  a special  case,  is  P's  competence  to  control  personally  the 
information  which  P would  like  to  keep  in  his  or  her  sole  possession. 

This  special  case  requires  P to  match  his  or  her  own  competencies 
(skills)  against  the  competencies  of  0 to  overcome  P's  suppression,  con- 
cealment, or  deception,  and  hence  to  decode  any  "informational  leakages" 
that  P provides. 

The  analysis  of  personal  control  also  must  handle  two  major  ways  of 
communicating  private  information:  selective  affiliation  and  selective 

communication.  Selective  affiliation  is  the  tailoring  of  an  audience 
in  a setting  to  "fit"  a communication.  The  secret  society  which  forbids 
the  revelation  of  its  secret  rituals  to  nonmembers  is  one  example. 

Another  example,  recognized  by  the  law,  is  the  privileged  communication 
(e.g. , lawyer-client,  physician-patient,  priest-penitent  communications). 
Selective  communication  is  the  tailoring  of  a communication  to  an  audi- 
ence in  a setting.  Examples  include  an  adult  spelling  "private"  messages 
to  another  adult  when  their  children  are  present,  multilinguals  shifting 
to  a language  which  is  (hopefully)  unfamiliar  to  those  they  wish  to 
exclude,  or  the  military  using  cryptological  procedures  to  encode 
messages.  Put  another  way,  selective  affiliation  refers  to  P's  belief 
that  the  audience  and  setting  for  a communication  are  adequately  under- 
stood and  controlled.  As  a result,  P can  make  the  revelation.  Selective 
communication  refers  to  control  over  message  content,  including  refrain- 
ing from  communication,  when  P considers  his/her  personal  control  over 
the  audience  and/or  setting  to  be  inadequate.  This  analysis  of  privacy 
implies  that,  for  P,  privacy  is  not  a matter  of  degree  or  level,  that  is, 
of  having  too  much  or  too  little  privacy  (cf.  Altman,  1975).  Rather, 

P's  evaluation  of  his/her  privacy  is  qualitative:  "I  have  successfully 

managed  information"  or  "I  have  not"  or  perhaps  "I  am  unsure."  However, 
the  effort  exercised  to  obtain  or  maintain  privacy  may  be  treated  as  a 
matter  of  degree  by  the  person.  A second  implication  of  this  position 
is  that  mechanisms  for  exercising  personal  control  are  governed  by  goal- 
oriented  concerns  and  are  modified  or  shifted  to  assure  movement  toward 
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an  unexpected  or  desired  goal.  However  there  is  no  definitive  list  of 
mechanisms  for  limiting  and  protecting  personal  information  (Altman, 

1975;  Laufer  and  Wolfe,  1977).  Rather  a variety  of  historical,  cultural, 
environmental,  and  other  factors  form  a context  for  establishing  one's 
goal  and  for  defining  the  means  that  might  or  should  be  successful  in 
reaching  it. 

The  proposed  analysis  of  personal  control  hypothesizes  that  P's  ability 
to  control  successfully  private  information  decreases  as  the  number  of 
recipients  increases.  It  also  hypothesizes  that  the  competence  to 
control  transmissions  and  to  properly  "read”  and  interpret  received 
messages  is  not  uniform  either  across  senders  or  for  the  same  sender 
at  different  times,  under  different  circumstances,  and  across  types  of 
private  information. 

The  relationship  between  the  concepts  of  personal  control  and  of  privacy 
are  complex.  Exercises  of  control  that  attain  privacy  offer  us  the 
opportunity  to  assess  and  evaluate  our  personal  experiences  with  these 
exercises  of  control.  These  assessments  and  evaluations  are  an  important 
determinant  of  our  judgments  of  ourselves  and  of  others.  Moreoever,  our 
successes  and  failures  at  attaining  outcomes  and  objectives  are  also 
informative  to  others;  they  tell  others  about  ourselves.  Insofar  as 
people  want  to  manage  the  information  others  have  about  them,  failures 
can  damage  an  impression.  This  can  be  costly.  This  is  a reason  why 
people  prepare  themselves  emotionally  and  practice  their  skills  in 
private.  Privacy  minimizes  the  chances  that  information  that  could 
damage  an  impression  becomes  public.  Paradoxically,  people  need  enough 
competence  to  successfully  obtain  privacy  in  order  to  have  the  opportu- 
nity to  "fail"  in  the  practice  or  exercise  of  other  behaviors.  Moreover, 
when  a "loss  of  control"  also  precipitates  a loss  of  privacy  — that  is, 

0 gains  access  to  personal  information  about  P above  and  beyond  that 
which  signifies  that  control  was  lost  — then  P must  contend  with  two 
sources  of  costs:  those  arising  from  the  loss  of  control  and  those 

arising  from  the  loss  of  privacy.  These  examples  illustrate  the  complex 
relationship  between  the  concepts  of  control  and  of  privacy. 

There  are  settings  that  permit  people  only  limited  control  over  intimate 
revelations  about  themselves.  The  courtroom  is  a case  in  point.  In  a 
courtroom,  for  example  during  a nasty  divorce  hearing,  personal  control 
is  directed  at  minimizing  the  potential  costs  that  can  arise  from  revel- 
ations. One  tactic  for  P is  to  recast  information  about  P either  by 
creating  a socially  acceptable  alternative  interpretation  of  events,  or 
by  demonstrating  that  there  were  mitigating  circumstances.  Another 
tactic  for  P is  to  blunt  the  impact  of  a revelation  by  0 by  questioning 
0's  motivation,  trustworthiness  or  credibility.  Because  the  courtoom 
articulates  the  thrust  and  parry  of  information  seeking  and  information 
management,  it  is  often  used  by  writers  to  convey  dramatically  the 
portrayal  of  information  management  and  of  personal  competence.  There 
also  are  examples  of  the  exercise  of  personal  control  of  information 
that  fall  beyond  the  scope  of  privacy.  These  include  cases  in  which  P 
controls  the  flow  to  0 of  information  over  which  P has  and  makes  no  claim 
of  "ownership"  and  which  is  intended  for  0.  This  illustrates  censorship, 
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not  privacy.  Examples  such  as  this  demonstrate  that  information 
management  extends  beyond  the7  concept  of  privacy  and  that  the  concept 
of  personal  control  is  a feature  of  many  types  of  information  management, 
including  privacy. 

2.5  COSTS 


It  is  assumed  that  so  long  as  people  feel  vulnerable  and  insofar  as 
information  about  themselves  can  be  a basis  for  pain  or  suffering, 
people  will  protect  that  information  and  will  limit  access  to  it  to 
avoid  a loss  of  privacy.  Pain  and  suffering  exemplify  the  social, 
psychological,  or  physical  costs  that  motivate  privacy  behavior.  Thus, 
the  privacy  of  silence  or  of  reserve  is  an  attempt  to  avoid  costs  by 
offering  no  target  for  sanctions.  However,  even  silence  can  be  informa- 
tive and  costly,  as  noted  in  an  example  in  Section  2.1  of  the  child 
who  had  forbidden  treats  before  mealtime. 

The  concept  of  cost  is  a troublesome  one.  It  has  two  basic  but  different 
meanings  (Emerson,  1976).  First,  there  is  the  psychological  meaning  of 
cost  as  stimulation  which  one  would  act  to  avoid  or  escape  from  or 
reduce.  Second,  there  is  the  economic  meaning  of  cost  as  rewards  that 
people  forego  because  resources,  such  as  time  or  effort,  that  could  have 
been  "invested"  in  better  outcomes  or  objectives  instead  were  invested 
in  less  rewarding  outcomes  or  objectives.  Although  the  first  meaning  is 
stressed  in  this  report,  both  meanings  are  consistent  with  how  the 
concept  of  cost  is  used  in  this  framework. 

With  regard  to  the  psychological  meaning  of  cost,  costs  can  vary  in 
their  nature,  severity,  and  source.  The  nature  of  the  costs  associated 
with  a loss  of  privacy  include  psychological  ones  — fear,  worry,  shame, 
guilt,  remorse  — as  well  as  actual  or  potential  social,  material,  or 
physical  costs.  The  severity  of  reactions  to  real  or  imagined  or 
anticipated  losses  of  privacy  can  vary  from  mild  emotional  reactions  and 
simple  cognitive  reappraisals  (Brehm,  1966)  to  severe,  even  pathological, 
reactions  including  self-destructive  acts.  The  reactions  may  be  cultur- 
ally appropriate  or  inappropriate  (with  suicide  a case  in  point). 

At  least  five  hypothesized  sources  of  stress  for  the  person  resulting 
from  the  loss  of  privacy  have  been  suggested  (although  not  always  in  the 
context  of  discussions  of  privacy).  These  include: 

(a)  Concern  about  being  stereotyped,  or  being  re-defined  by 
others,  in  a way  that  is  psychologically  damaging;  it  is 
a concern  about  how  one  will  have  to  present  one's  self 
now  that  the  "truth"  is  out;  it  is  a concern  about  the 
attributions  that  others  will  make  about  one's  self.  In 
sum,  it  is  a concern  about  how  one  is  defined  by  others, 
and,  by  implication,  about  self-definition  (Altman,  1975). 
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(b)  Concern  about  the  sheer  asymmetry  of  exposure  (you  stand 
naked  and  exposed  while  others  remain  hidden),  and  about 
ridicule  and  contempt  by  others  arising  from  being  found 
in  this  situation  or  from  what  is  revealed  (Westin,  1967). 

Whereas  (a)  focuses  on  how  one  is  defined,  (b)  focuses  on  how  one  is 
evaluated. 


Concern  about  differential  power  others  gain  over  one  from 
the  loss  of  privacy.  Whether  the  strategy  for  control  by 
others  stems,  for  example,  from  threats  (blackmail)  or 
from  an  increased  ability  to  predict  P's  behavior,  each 
critically  focuses  on  the  behavioral  options  now  open  to 
the  exposed  person  (Johnson,  1975). 

Concern  about  overt  punishment  (above  and  beyond 
ridicule) — imprisonment,  exile,  torture,  death. 

Punishments  also  include  a loss  of  privileges,  of  one's 
job,  of  one's  money.  The  loss  of  friends  and  the  loss 
of  the  support  of  others  are  also  possible  forms  of 
punishment. 

In  (b)  the  costs  are  purely  psychological;  in  (d)  they  are  physical, 
social,  and  psychological.  Speaking  metaphorically,  (b)  represents 
heaping  on  you  what  you  do  not  want,  and  (d)  illustrates  taking  from 
you  and  what  you  do  want. 

(e)  Concern  about  self-punitive  reactions  (e.g,  superego 

reactions,  to  use  the  classical  psychoanalytic  image). 

P is  the  target  of  self-directed  negative  sanctions: 
shame,  guilt,  embarrassment;  a feeling  of  being  disgraced, 
worthless,  contemptible.  Self-censure  is  a very  potent 
threat  and  is  one  major  reason  why  people  limit  access 
to  personal  information  by  others.  Under  special  condi- 
tions, people  even  may  limit  their  own  access  to  their 
"secrets"  (e.g.,  repression). 

Cost  minimization  resulting  from  privacy  behavior  has  an  important  posi- 
tive consequence.  There  are  behavioral  options  which,  because  of  their 
form  or  content,  have  high  cost  implications.  Without  privacy,  it  is 
not  likely  these  options  would  be  selected.  However,  with  privacy,  the 
likelihood  of  these  behavioral  options  being  selected  increases.  For 
example,  the  social  psychological  literature  has  amply  demonstrated 
that  people  may  not  honestly  express  their  "private"  opinions  if  they 
believe  that  expressing  them  "publically"  would  result  in  social  censure 
or  worse  (Berscheid,  1977). 

2.6  BOUNDARY  REGULATION 


(c) 


(d) 


Privacy  behavior  has  been  described  as  a boundary  regulation  process 
(Altman,  1975).  Boundary  regulation  represents  P's  understanding, 
perception  and  evaluation  of  conditions  whose  goal  is  the  successful 
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separation  of  P,  his/her  personal  information  (X),  and  perhaps  invited 
recipients  and  their  information,  from  other,  unacceptable  potential 
recipients  (0).  These  conditions  include  the  social  relationship  between 
P and  0,  the  nature  of  the  physical  setting  (see  Section  2.7),  etc. 

Boundary  regulation  is  intimately  tied  to  specific,  on-going  circum- 
stances including  past,  present,  and  future  events  as  currently  under- 
stood by  P.  As  circumstances  change,  P may  modify  his/her  privacy 
behavior  in  order  to  maintain  control.  Persons  in  conversation  who 
stop  talking  or  suddenly  switch  topics  because  a stranger  approaches 
illustrate  boundary  regulation. 

Although  the  nature  of  the  physical  setting  directly  and  powerfully 
influences  the  boundary  regulation  process,  boundaries,  strictly 
speaking,  are  a psychological  concept.  Nevertheless,  the  term  "boundary" 
or  its  synonym  "barrier”  sometimes  will  be  used  metaphorically  to  suggest 
a physical  shell  or  membrane  that  surrounds  and/or  separates,  thereby 
protecting  people  and  information. 

Multiple  boundaries  are  frequent.  It  is  only  for  analytic  convenience 
that  there  is  a focus  on  one  or  another.  Moreover,  the  framework  distin- 
guishes between  (a)  actions  that  represent,  create,  or  maintain  the 
barrier  itself,  such  as  encryption,  (b)  actions  that  occur  within 
barriers,  typically  "private"  transmissions,  such  as  self-disclosures, 
and  (c)  actions  that  occur  across  barriers,  such  as  activities  for  which 
anonymity  is  a precondition. 

Two  examples,  from  P's  perspective,  will  illustrate  these  distinctions. 
The  first  example:  The  conditions  that  protect  conversationalists  from 

uninvited,  unacceptable  others  [Point  (a),  above]  offer  the  participants 
an  opportunity  to  share  private  information  among  themselves  [Point  (b), 
above].  In  other  words,  for  P,  intimate  exchanges  [Point  (b)]  take 
place  within  the  barrier  that  separates  the  participants  from  uninvited 
others  [Point  (a)].  The  barrier  is  a means;  the  disclosures  are  its 
goal  (cf.  Derlega  and  Chaiken,  1977). 

The  second  example:  Anonymity  refers  to  barriers  to  personal  identifi- 

cation. That  is,  boundary  regulation  processes  are  devoted  to  protecting 
indicators  of  personal  identity  from  being  communicated  to  others.  Given 
anonymity,  the  probabilities  for  certain  behavioral  options  increase 
[Point  (c),  above].  The  options  include  dealing  in  questionable  or 
illegal  or  immoral  activities,  or  trying  out  or  presenting  ideas  which 
would  otherwise  be  suppressed.  The  point  is  that  these  activities  occur 
because  personal  identification  is  protected.  Thus,  anonymity  is  a 
means  for  increasing  options.  The  selected  option,  in  turn,  can  be  a 
means  to  a desired  end. 

The  concept  of  boundary  regulation  focuses  on  individuals'  judgments 
of  their  barriers.  If  two  people  create  similar  barriers,  the  barrier 
of  each  remains  an  individual  matter.  The  idea  of  two  people  sharing 
a single  barrier  or  sharing  boundary  regulation  in  any  strict  sense  is 
rejected.  Furthermore,  subjective  evaluations  of  barrier  effectiveness 
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need  not  be  accurate  nor  must  the  evaluations  of  barriers  by  different 
participants  in  a given  setting  be  in  agreement.  Thus,  if  two  person  are 
in  a physically  isolated  setting  discussing  secret  matters,  the  setting, 
although  physically  shared,  is  not  necessarily  psychologically  shared. 
That  is,  each  of  the  individuals  can  perceive  and  evaluate  the  shared 
setting  in  ways  that  might  or  might  not  be  the  same.  This  example  does 
not  mean  that  the  status  of  the  physical  environment  is  limited  to  its 
psychological  representation.  This  is  not  the  case,  as  the  next  section 
will  forcefully  argue. 

2.7  THE  PHYSICAL  ENVIRONMENT 


If  privacy  behavior  is  P's  competence  to  control  the  flow  and/or  content 
of  an  information  transmission,  this  competence  must  be  directed  at 
current  and  future  (potential)  audiences  who  might  invade  or  violate 
P's  privacy.  Interactions  and,  by  implication,  communications  with 
others  take  place  in  physical  settings.  Characteristics  of  settings 
influence  and  shape  interpersonal  and  personal  behavior.  In  turn,  an 
individual  can  use  a physical  setting  to  meet  personal  or  interpersonal 
ends,  for  example,  by  the  manipulation  of  environmental  characteristics 
or  by  choosing  a setting  that  meets  the  person's  strategic  needs.  Thus, 
if  we  wish  to  hide  the  fact  that  we  are  in  a particular  place,  we  can 
disguise  ourselves,  plant  a "look  out"  to  monitor  intruders,  or  choose 
a physical  location  which  permits  us  to  observe  others  but  which  does 
not  give  others  a good  opportunity  to  observe  us.  A complete  theoretical 
account  of  interpersonal  behavior,  particularly  of  behavior  directed  at 
actual  and  potential  audiences,  requires  an  understanding  of  the  physical 
environment.  In  sum,  the  competence  to  adequately  understand  and  use  the 
environment  is  a necessary  aspect  of  control  over  information 
transmission. 

The  influence  of  the  built  environment  on  behavior  is  mediated  by  the 
subjective  and  objective  aspects  of  a setting.  The  subjective  aspects 
refer  to  those  psychological,  social  and  cultural  factors  that  shape  our 
judgments,  perceptions  and  evaluations  of  the  physical  environment. 
Examples  of  subjective  factors  are  the  influence  of  culture  on  visual 
perception  (Segall,  Campbell  and  Herskovits,  1966),  social  norms  about 
appropriateness  of  specific  settings  for  specific  behaviors  (see  Wolfe 
and  Laufer,  1975,  for  examples),  and  the  emphasis  on  psychological 
aspects  of  space,  represented  by  the  use  of  concepts  such  as  territorial- 
ity and  personal  space,  in  explaining  environmental  impacts  on  behaviors 
(Altman,  1975).  Theories  that  address  environmental  aspects  of  privacy 
tend  either  to  emphasize  or  more  completely  explicate  these  subjective 
factors  (e.g.,  Altman,  1975). 

The  objective  aspects  of  the  physical  environment  refer  to  the  enduring, 
rather  than  ascribed,  characteristics  of  the  physical  environment. 
Objective  aspects  include  the  dimensions,  shapes  and  physical  properties 
of  objects  as  well  as  their  distribution  and,  by  implication,  organiza- 
tional in  space.  These  aspects  are  often  mentioned  in  environmentally- 
oriented  theories  of  privacy  but  these  aspects  are  seldom  explicated. 
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A full  understanding  of  objective  aspects  is  still  necessary.  The 
objective  aspects  create  the  initial  conditions  or,  alternatively,  the 
opportunities  for  behavior.  The  subjective  factors,  by  comparison,  can 
influence  our  evaluation  and  judgment  of  the  objective  aspects,  for 
example,  or  our  selection  from  among  opportunities  (cf.  Rapoport,  1969). 
Therefore,  without  an  understanding  of  the  objective  aspects,  environ- 
mental analyses  necessarily  will  remain  "one  step  away"  from  a complete 
account  of  how  the  spatial  characteristics  of  settings  influence  the 
behavior  occuring  within  the  settings. 

For  these  reasons,  the  proposed  theoretical  analysis  of  environmental 
aspects  of  privacy  will  focus  on  the  relationship  between  human  sensory 
capacities  and  the  geography  of  settings.  This  theoretical  analysis 
must  be  able  to  generate,  from  physical  descriptions  of  (a)  the  physical 
settings,  (b)  the  physical  status  and  personal  background  of  persons  in 
the  setting  and  (c)  the  location  and  head-and-body  orientation  of  persons 
in  the  setting,  estimates  of  (d)  the  sensory  information — visual,  audi- 
tory or  olfactory — available  to  the  person  and  (e)  the  sensory  informa- 
tion about  the  person  (arising,  for  example,  from  P's  appearance,  dress, 
comments,  location,  posture,  etc.)  available  to  others  who  are  or  who 
might  enter  the  settings.  The  analysis  also  requires  a method  for 
mapping  sensory  information  for  all  points  and  head-body  orientations 
in  a physical  setting.  Based  on  the  map,  a method  is  required  for 
determining  what  information  about  the  environment  and  others  P has  or 
could  have  access  to  and  the  information  about  P that  is  or  could  be 
exposed  to  0.  We  must  be  able  to  coordinate  this  environmental  analysis 
with  a behavioral  analysis  of  how  P might  choose  or  use  his  or  her 
position  in  the  setting  to  personal  advantage.  Archea  (1974,  1977)  has 
developed  an  environmental  analysis  that  meets  many  of  these  objectives. 
In  sum,  the  proposed  theory  must  provide  an  objective  representation  of 
the  physical  environment  that  is  behaviorally  relevant  and  must  provide 
the  linkages  between  environmental  and  behavioral  descriptions. 

To  illustrate  what  such  a theory  can  be  like,  Archea  *s  (1974,  1977) 
access-exposure  model  of  spatial  behavior  will  be  described.  This  is 
currently  the  best  explanation  of  spatial  behavior  which  draws  on  the 
objective  aspects  of  the  environment,  provides  explicit  linkages  between 
environmental  and  behavioral  concepts,  and  has  an  associated  measurement 
methodology  for  mapping  the  environmental  conditions  that  are  visually 
available  to  persons  in  a setting.  Moreover,  this  theory  recently  has 
been  applied  to  the  concept  of  privacy  (Archea,  1977). 
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The  description  of  Archea 's  model  is  from  Archea  (1977)  and  all  page 
citations  in  this  section  are  to  this  article.  However  examples  and 
commentary  have  been  added,  when  appropriate.  Only  portions  of 
Archea 's  model  are  included  here.  For  example,  the  mapping  technique, 
mentioned  above,  has  been  excluded  because  the  early  version  (Archea, 
1974)  is  under  revision;  a report  on  the  revised  version  is  in  pre- 
paration (J.  Archea,  personal  communication,  March  1979). 
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Archea 's  model  builds  on  the  distinction  between  properties  and  attri- 
butes. Properties  are  defining  characteristics  that  make  things  what 
they  are.  Properties  are  always  present;  they  impose  limits  on  what 
things  can  do.  Attributes  are  extrinsic  characteristics  that  relate 
things  to  other  things  for  specific  purposes.  Attributes  are  contingent 
upon  what  things  do  in  relation  to  other  things;  in  effect,  they  are  the 
performance  characteristics  of  situations  created  when  things  come 
together.  Properties,  then,  are  objective  characteristics  from  which 
all  other  characteristics  of  a thing  derive  their  status  whereas  attri- 
butes are  conventions.  Another  important  distinction  is  between  settings 
and  situations.  Settings  are  physically  and  temporally  bounded  places. 
Situations  consist  of  activities  or  events  in  settings.  Thus,  settings 
are  environmental  whereas  situations  have  both  environmental  and 
behavioral  characteristics.  (p.  119) 

For  Archea,  privacy  is  an  attribute  of  situations,  and  not  of  the 
environment  or  of  behavior  alone.  As  such,  privacy  derives  its  status 
from  constraints  that  both  physical  and  human  properties  impose  on 
interpersonal  behavior.  It  follows  that  a complete  understanding  of 
privacy  requires  a model  of  spatial  behavior  that  examines  settings, 
social  behavior,  and  their  linkages,  and  which  can  explain  how  the 
objective  environment  influences  social  behavior. 

Archea' s model  emphasizes  the  idea  of  information  fields:  "Each  person 

is  the  center  of  a dynamic  field  of  information  about  surrounding 
events...  to  which  his  or  her  behavior  is  a continuous  adjustment" 

(p.  121).  Thus,  the  regulation  of  a person's  interpersonal  behavior 
is  influenced,  by  the  person's  possibilities  for  monitoring  information 
from  (the  behavior  of)  others,  which  Archea  calls  access , and  by  the 
possibilities  of  others  monitoring  information  about  the  person's  behav- 
ior, which  is  called  exposure.  That  is,  a person  can  have  access  to 
information  about  others  and  can  have  their  behavior  exposed  to  others, 
(p.  121) 

In  this  model,  visual  information  is  stressed.  According  to  the  model, 
the  distribution  of  visual  information  is  regulated  by  the  physical 
properties  of  the  environment.  Spatial  organization,  then,  establishes 
the  options  of  those  in  the  setting.  Because  options  can  differ  in 
their  social  consequences  for  people,  spatial  organization  is  critical 
to  what  people  do  and  when  and  where  they  do  it.  By  properly  selecting 
what,  when  and  where,  people  can  control  the  impression  they  create  and 
the  social  consequences  of  their  behavior  for  themselves. 

Archea  advances  three  derivative  propositions.  First,  situations  change 
over  time.  Settings,  by  contrast,  are  relatively  stable  over  time. 
Therefore,  people  have  to  monitor  what  is  currently  happening  in  a set- 
ting and  must  monitor  those  places  in  a setting  (such  as  doors,  through 
which  people  may  suddenly  enter  a setting)  where  events  could  develop. 
Second,  people  can  manipulate  access  and  exposure  be  strategically 
locating  themselves  in  setting.  This  behavior  can  control  the  evalua- 
tions and  sanctions  of  others  for  one's  actions  in  personally  desired 
ways.  Third,  personal  and  situational  attributes  may  determine  the 
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effectiveness  of  visual  access  and  exposure  on  personal  accountability. 
For  example,  people  may  act  inappropriately  and  not  be  held  accountable 
if  they  have  recognizable  excuses  for  their  behavior,  such  as  inexperi- 
ence or  illness.  (p.  121) 

Expanding  on  these  propositions,  behavior  is  linked  to  the  environment 
by  the  manner  in  which  physical  properties  of  the  environment,  such  as 
the  position  or  opacity  of  objects,  mediate  the  flow  and  appearance  of 
information.  In  turn,  people  process  information  in  order  to  coordinate 
their  behavior  with  both  the  ongoing  and  to  the  anticipated  actions  of 
others.  Information  processing  is  based  on  a number  of  behavioral  attri- 
butes and  their  underlying  human  properties.  The  behavioral  attributes 
include  the  person's  location  and  orientation  in  space,  sensory  acuity, 
and  familiarity  with  the  setting.  The  underlying  human  properties 
include  the  structure  of  memory  and  the  degree  of  resolution  and  the 
directionality  of  particular  sensory  equipment.  (pp.  122-123)  As  a 
result  of  information  processing,  people  may  adjust  their  behavior. 

Such  adjustments  will  constitute  new  information  which  is  distributed 
across  the  information  field  as  the  organization  of  the  setting  permits. 
Thus,  an  information  field  is  dynamic. 

The  influence  of  the  environment  is  also  dynamic.  This  stems  from  the 
ways  the  environment  is  used.  The  principal  way  is  the  adjustment  of 
one's  position  in  a setting,  or  even  of  the  props  in  a setting  (e.g., 
degree  to  which  a door  is  open,  or  the  location  of  a chair  or  lamp), 
in  order  to  control  what  about  one's  self  is  exposed  to  others.  This, 
of  course,  is  the  essence  of  privacy. 

With  regard  to  privacy,  the  model  argues  that  it  is  easier  to  selectively 
conceal  and  disclose  "coextensive"  (here-and-now)  information  than 
"trace"  information.  A trace  is  information  which  survived,  physically 
or  psychologically,  the  events  which  initially  formed  the  information. 
Fingerprints  and  reputations  are  examples  of  trace  information.  The 
model  also  argues  that  loss  of  privacy  is  associated  with  too  much 
exposure,  hence  more  information  is  available  to  others  about  a person 
than  the  person  desires.  It  is  also  associated  with  too  little  access, 
hence  the  information  needed  to  gauge  the  appropriateness  of  behavior 
is  reduced  which  increases  the  probability  that  the  person  will  present 
him/herself  to  others  in  a way  for  which  the  person  does  do  not  want  to 
be  held  accountable,  (pp.  129-130). 

In  sum,  Archea's  model  of  spatial  behavior  links  the  physical  environment 
with  behavioral,  particularly  social,  variables.  The  role  and  nature  of 
the  physical  environment  is  examined  and  its  applicability  to  situational 
attributes,  such  as  privacy,  has  been  explored.  Although  Archea's  1977 
model  is  not  a final  statement,  it  is  still  a large  step  toward  defining 
and  measuring  the  physical  environment  independently  of  the  way  in  which 
behavior  is  typically  defined  and  measured.  (p.  134f) 
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2. 8 SUMMARY 


As  preparation  for  developing  a theory  of  privacy,  a conceptual  analysis 
of  privacy  was  undertaken  that  provides  a framework  for  theory  develop- 
ment. The  framework  focuses  on  privacy  as  strategies  of  information 
management  that  attempt  to  handle  the  personally  costly  consequences  of 
unlimited  or  unprotected  distribution  of  personal  information.  The 
framework  stresses  social  psychological  factors.  However,  it  also 
strongly  endorses  the  view  (Archea,  1977;  Margulis,  1977a)  that  a 
complete  understanding  of  social  behavior,  including  privacy,  requires 
an  explicit,  account  of  the  nature  of  the  objective  physical  environment 
and  a clear  statement  of  the  relationship  between  behavior  and  the 
physical  environment. 
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